T&T compliance matrix — every capability, mapped to the law
This matrix maps each platform capability to the Trinidad & Tobago Whistleblower Protection Act (Act No. 9 of 2024), the EU Whistleblower Directive (2019/1937), and ISO 37002:2021. It is designed to be copied verbatim into procurement evaluation grids, vendor-risk questionnaires, and board papers — with a verification column pointing to where each control can be inspected. It is general information, not legal advice.
Capability → obligation matrix
Column key: WPA = Whistleblower Protection Act, No. 9 of 2024 (Trinidad & Tobago — passed and assented, awaiting Presidential proclamation of commencement); EU 2019/1937 = Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law; ISO 37002 = Whistleblowing management systems — guidance.
| Platform capability | WPA — Act No. 9 of 2024 (TT) | EU Directive 2019/1937 | ISO 37002:2021 | Where to verify |
|---|---|---|---|---|
| Anonymous web portal (branded, per organization) | Confidential disclosure channel (core theme of the Act) | Art. 8(1) — internal reporting channels; Art. 8(3) — anonymous disclosures accepted | §5.2 — confidential reporting channels | Live portal · Dashboard → Settings → Portal links |
| Encrypted AES-256-GCM content (per-tenant derived keys) | Identity protection for reporters (core theme) | Art. 16-19 — protection of confidentiality and personal data | §7.4 — protection of the reporting party | Security page · Whitepaper §4 · /security#encryption |
| Zero-identity two-way anonymous messaging | Reporter follow-up without revealing identity | Art. 9(1)(f) — diligent follow-up; Art. 9(1)(c) — feedback | §5.4 — timely feedback; §7.4 — anonymity protection | Portal check-in flow · Admin case view |
| WORM hash-chain audit trail (SHA-256, append-only, DB triggers) | Secure, tamper-evident record keeping | Art. 12 — record-keeping duties; ISO 27001 A.8.15 compatible | §7.3 — documentation and record management | Dashboard → Audit logs · Integrity seal verification API |
| SLA engine — acknowledgment / follow-up / response + 3-level escalation | Structured internal handling before external disclosure | Art. 9(1)(c) — acknowledgement within 7 days; Art. 9(1)(f) — reasonable timeframe feedback | §5.4 — timely feedback; §8.4 — investigation process | Dashboard → Analytics · Quarterly board report |
| Phone voicemail hotline (Twilio DID → encrypted pipeline) | Multiple disclosure channels (core theme) | Art. 8(1) — channels may include telephone | §5.2 — channels appropriate to the organization (incl. voice) | Dashboard → Settings → Phone hotline · Recordings are pitch-masked and encrypted |
| WhatsApp deep-link channel (portal entry, never an inbox) | Multiple accessible disclosure channels | Art. 8(1) — accessible channels; recital 44 — accessibility | §5.2 — accessible reporting channels | Dashboard → Settings → WhatsApp reporting channel |
| Voice disguising on voice reports (WSOLA pitch masking) | Identity protection for reporters | Art. 16 — duty of confidentiality of identity | §7.4 — protect reporter identity | Voice recordings stored post-masking · Whitepaper §4 |
| 12-item investigation checklist per case (NAVEX-aligned) | Structured internal handling of disclosures | Art. 9(1)(f) — diligent follow-up | §8 — receiving and investigating (12-step practice) | Admin case view → Investigation checklist |
| Role-based access + conflict-of-interest department shields | Restricted handling of disclosures | Art. 17 — competent and impartial follow-up | §8.2 — impartial investigation; §8.1 — competence | Dashboard → Team members · per-admin department restrictions |
| Configurable retention with automated purge cron | Disciplined records management | Art. 12(3) — data kept no longer than necessary (GDPR Art. 5(1)(e)) | §7.3 — retention and disposal of records | Dashboard → Settings → Data retention · /api/cron/retention |
| Quarterly board PDF report (aggregate, no content exposure) | Management oversight of the reporting programme | Art. 14 — reporting to management; Art. 13(1)(g) — oversight practice | §5.6 — reports to governance bodies; §6.4 — performance monitoring | Dashboard → Export → Board quarterly report (PDF) |
| Compliance CSV export (audit and regulator ready) | Records available for authorised disclosure/oversight | Art. 12 — record-keeping; Art. 14 — reporting to management | §7.3 — documented information | Dashboard → Export → Cases export (CSV) |
| Custom white-label domain per tenant (e.g. etica.aseguradora.com.tt) | Channel under the organization’s own authority builds reporter trust | Art. 8(1) — internal channels controlled by the organization | §5.2 — channels owned by the organization | Dashboard → Settings → Custom domain · DNS-verified via Vercel |
| Passkeys (WebAuthn) + TOTP 2FA + progressive lockout | Secure system and access control | GDPR Art. 32 — security of processing | §7.2 — secure information handling | Dashboard → Settings → 2FA & Passkeys · Whitepaper §5 |
| No IP logging · metadata stripping on uploads · fail-closed encryption | Identity protection for reporters | GDPR Art. 25 — data protection by design and by default | §7.4 — protect the reporting party from retaliation risk | Privacy policy · Whitepaper §4-5 · /security#privacy |
| WCAG 2.1 AA conformance (portal and dashboard) | Channels usable by all employees | Recital 44 — accessible reporting channels | §5.2 — accessible to all workers | Accessibility statement · /accessibility |
About "Act No. 9 of 2024" citations
The Act was passed and assented in 2024 but has not yet been proclaimed into force — commencement requires a Presidential proclamation. Until proclamation, the WPA column expresses the Act's core themes (confidential channels, identity protection, secure records, structured handling) rather than enforceable section numbers. Once the Act is proclaimed and regulations are published, this matrix will be updated with section-level citations. EU 2019/1937 and ISO 37002 citations reflect instruments already in force, so multinational and EU-linked organizations can rely on them today.
1. Copy the matrix
Use the copy-as-CSV button above and paste the rows straight into your vendor evaluation grid or tender response. No formatting surgery needed.
2. Verify the controls
The verification column tells your reviewers where each control lives — a live portal, the audit-log view, the export module, or the security whitepaper.
3. Attach the evidence pack
Pair this matrix with the security whitepaper and the Data Processing Addendum for a complete due-diligence pack your risk committee can sign off.
Due-diligence pack — related documents
Important disclaimer
This matrix is provided for general information only and does not constitute legal advice, a legal opinion, or a statement of the law. Legislative status — including the proclamation status of the Whistleblower Protection Act 2024 — changes over time; verify current provisions with qualified Trinidad & Tobago or Caribbean counsel before making compliance or procurement decisions. Zeitgeist Confidential does not warrant that use of the platform satisfies any specific legal or regulatory obligation.